Banks & fintechs
Email security of 67 banks & fintechs
The domains that move money have the most to lose from a spoofed email — here is how their inbound email authentication actually holds up.
Across these 67 domains, 100% publish SPF, 98.5% publish DMARC and 98.5% enforce it (reject or quarantine), 0% sit on p=none, and 58.2% sign with DKIM. Scanned June 24, 2026.
Every domain in this cohort
| Domain | SPF | DMARC | DKIM | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|
| adyen.com | Hardfail | Reject | Yes | No | No |
| affirm.com | Softfail | Quarantine | Yes | No | No |
| afterpay.com | Hardfail | Reject | Yes | No | No |
| ally.com | Softfail | Reject | No | No | No |
| americanexpress.com | Hardfail | Reject | No | No | No |
| axisbank.com | Hardfail | Reject | Yes | No | No |
| bankofamerica.com | Softfail | Reject | No | No | No |
| barclays.co.uk | Hardfail | Reject | No | No | No |
| bbva.com | Hardfail | Reject | No | No | No |
| binance.com | Hardfail | Quarantine | Yes | No | No |
| blackrock.com | Softfail | Quarantine | No | No | No |
| bnpparibas.com | Hardfail | Reject | No | No | No |
| capitalone.com | Softfail | Reject | No | No | No |
| chase.com | Hardfail | Reject | No | No | No |
| chime.com | Softfail | Reject | Yes | No | No |
| citi.com | Present | Reject | No | No | No |
| citibank.com | Softfail | Reject | No | No | No |
| coinbase.com | Hardfail | Reject | Yes | No | No |
| commbank.com.au | Softfail | Reject | Yes | No | No |
| credit-suisse.com | Hardfail | Reject | No | No | No |
| crypto.com | Hardfail | Reject | Yes | No | No |
| db.com | Softfail | Reject | No | No | No |
| deutsche-bank.com | Hardfail | Reject | No | No | No |
| discover.com | Softfail | Quarantine | Yes | No | No |
| etoro.com | Softfail | Reject | Yes | No | No |
| fidelity.com | Hardfail | Reject | Yes | No | No |
| gemini.com | Hardfail | Reject | Yes | No | No |
| goldmansachs.com | Softfail | Reject | No | No | No |
| hdfcbank.com | Hardfail | Reject | Yes | No | No |
| hsbc.com | Softfail | Reject | Yes | No | No |
| ing.com | Hardfail | Reject | Yes | No | No |
| interactivebrokers.com | Hardfail | Reject | Yes | No | No |
| itau.com.br | Hardfail | Reject | Yes | No | No |
| jpmorgan.com | Hardfail | Reject | No | No | No |
| jpmorganchase.com | Hardfail | Reject | No | No | No |
| klarna.com | Hardfail | Reject | Yes | No | No |
| kraken.com | Hardfail | Reject | Yes | No | No |
| mastercard.com | Softfail | Reject | Yes | No | No |
| mollie.com | Hardfail | Quarantine | Yes | No | No |
| monzo.com | Hardfail | Reject | Yes | No | No |
| morganstanley.com | Softfail | Reject | No | No | No |
| mufg.jp | Softfail | Reject | Yes | No | No |
| n26.com | Softfail | Reject | Yes | No | No |
| nomura.com | Softfail | Reject | No | No | No |
| nordea.com | Hardfail | Reject | Yes | No | No |
| payoneer.com | Hardfail | Reject | Yes | No | No |
| paypal.com | Softfail | Reject | No | No | No |
| plaid.com | Softfail | Reject | Yes | No | No |
| rbc.com | Hardfail | Reject | No | No | No |
| revolut.com | Softfail | Quarantine | Yes | No | No |
| robinhood.com | Softfail | Quarantine | Yes | No | No |
| santander.com | Hardfail | Reject | No | No | No |
| sbi.co.in | Hardfail | Reject | Yes | No | No |
| schwab.com | Hardfail | Reject | Yes | No | No |
| sezzle.com | Softfail | Reject | Yes | No | No |
| sofi.com | Softfail | Reject | Yes | No | No |
| square.com | Softfail | Reject | No | No | No |
| stripe.com | Softfail | Reject | Yes | No | No |
| td.com | Hardfail | Reject | No | No | No |
| ubs.com | Hardfail | Reject | No | No | No |
| vanguard.com | Softfail | Reject | No | No | No |
| visa.com | Softfail | Quarantine | No | No | No |
| wellsfargo.com | Softfail | Reject | No | No | No |
| westpac.com.au | Hardfail | Reject | Yes | No | No |
| wise.com | Softfail | Reject | Yes | No | No |
| worldpay.com | Hardfail | Reject | Yes | No | No |
| icicibank.com | Hardfail | Missing | Yes | No | No |
Want the same breakdown for your own domain? Run a free dossier or get a signed audit report.